EIP-2026-113019

This exploit demonstrates a SQL injection vulnerability in vBulletin's ChangUonDyU Advanced Statistics plugin via the 'listforumid' parameter in ajax.php. The PoC includes crafted UNION SELECT queries to extract database information and user credentials.